WHAT IS CLAIMED IS: 

1 . In a management system including a management computer and one or 
more managed computers to be managed by the management computer, the management 
computer comprising: 

a communication device configured to receive operating data of a monitoring 
object inside a managed computer and information relating to an event; and 

a processor configured to identify from the operating data received by the 
commxmication device a portion of the operating data which relates to the event, based on the 
operating data and the information relating to the event indicating trouble occurrence or 
performance decrement of the monitoring object. 

2. The management computer as set forth in claim 1, 
wherein the information relating to the event includes at least one of 

information showing presence or absence of occurrence of the event, information showing an 
occurrence time of the event, and information showing a classification of the event, and 

wherein the processor of the management computer is configured to identify 
the portion of the operating data which relates to the event, based on the operating data and 
the information relating to the event including at least one of the information showing 
presence or absence of occurrence of the event, the information showing the occurrence time 
of the event, and the information showing the classification of the event. 

3. The management computer as set forth in claim 1, wherein the 
management computer is configured to manage a plurality of managed computers, wherein 
the communication device is configured to receive operating data of monitoring objects 
inside the plurality of managed computers and information relating to an event, wherein the 
information relating to an event includes host infomiation identifying from the operating data 
received by the communication device a portion of the operating data which is received fi-om 
the managed computer in which the event occurred, and wherein the processor of the 
management computer is configured to identify the portion of the operating data which 
relates to the event, based on the operating data and the information relating to the event 
including the host information. 

4. The management computer as set forth in claim 3, wherein the 
information relating to the event includes information showing presence or absence of 
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occurrence of the event, and wherein the processor of the management computer is 
configured to identify the portion of the operating data which relates to the event, based on 
the operating data and the infomiation showing presence or absence of occurrence of the 
event. 

5. The management computer as set forth in claim 1, wherein the 
monitoring object includes at least one of a hardware structure part in a storage device 
connected to the management computer through a network and a program stored in the 
storage device in the managed computer. 

6. The management computer as set forth in claim 1 wherein the portion 
of the operating data identified by the process is to be used for trouble analysis and to carry 
out the trouble analysis. 

7. A management system comprising a management computer and a 
managed computer which is managed by the management computer, 

wherein the managed computer includes: 

a managed computer processor which is configured to obtain operating 
data from a monitoring object and to generate information relating to an event indicating 
trouble occurrence or performance decrement of the monitoring object; and 

a managed computer communication device which is configured to 
transmit the operating data from the monitoring object and the information relating to the 
event to the management computer, and 

wherein the management computer includes: 

a management computer communication device which is configured to 
receive from the managed computer communication device the operating data and the 
information relating to the event; and 

a management computer processor which is configured to identify 
from the operating data received by the management computer communication device a 
portion of the operating data relating to the event, based on the portion of the operating data 
and the information relating to the event. 

8. The management system as set forth in claim 7, 

wherein the management computer further includes an operating data buffer 
and a data storage; and 
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wherein the management computer processor is configured to store the 
operating data fi-om the managed computer in the operating data buffer; and 

wherein the management computer processor is configured, when the 
information relating to the event is received, to store the information relating to event in the 
operating data buffer in association with the operating data stored in the operating data 
buffer, to write the stored operating data and the information relating to the event fi-om the 
operating data buffer to the data storage, and to identify firom the operating data received by 
the management computer communication device a portion of the operating data relating to 
the event, based on the stored operating data and the information relating to the event written 
to the data storage. 

9. The management system as set forth in claim 7, 

wherein the management computer further includes an operating data buffer 
and a data storage; and 

wherein the management computer processor is configured to store the 
operating data from the managed computer in the operating data buffer; 

wherein the management computer processor is configured, when the 
information relating to the event is received, to store the information relating to event in the 
operating data buffer in association with the operating data stored in the operating data 
buffer, to write a part of the stored operating data and the information relating to the event 
from the operating data buffer to the data storage, the part of the stored operating data to be 
written to the data storage relating to the event, based on the part of the stored operating data 
and the information relating to the event written to the data storage. 

1 0. The management system as set forth in claim 7, 

wherein the management computer further includes an operating data buffer 
and a data storage; and 

wherein the management computer processor is configured to store the 
operating data from the managed computer in the operating data buffer; and 

wherein the management computer processor is configured, when the 
information relating to the event is received, to store the information relating to event in the 
operating data buffer in association with the operating data stored in the operating data 
buffer, to determine a part of the operating data to be written from the operating data buffer to 
the data storage based on the information relating to the event, and to write the part of the 



17 



stored operating data from the operating data buffer to the data storage, and to carry out the 
trouble analysis based on the part of the stored operating data written to the data storage. 

11. A management system comprising a management computer and a 
managed computer which is subjected to trouble monitoring by the management computer, 

wherein the managed computer includes: 

a managed computer processor which is configured to obtain operating 
data from a monitoring object and to generate information relating to an event indicating 
trouble occurrence or performance decrement of the monitoring object; and 

a managed computer communication device which is configured to 
identify the operating data relating to the event and to transmit the identified operating data to 
the management computer, based on the identified operating data and the information relating 
to the event; and 

wherein the management computer includes: 

a management computer communication device which is configured to 
receive the identified operating data from the managed computer communication device; and 

a management computer communication processor which is configured 
to carry out the trouble analysis based on the received operating data. 

12. A management computer for monitoring a monitoring object, the 
management computer comprising: 

a communication device configured to receive operating data of a monitoring 
object and information relating to an event; and 

a processor configured to identify from the operating data received by the 
communication device a portion of the operating data which relates to the event, based on the 
operating data and the information relating to the event indicating trouble occurrence or 
performance decrement of the monitoring object. 

13. The management computer as set forth in claim 12, 

wherein the management computer further includes an operating data buffer 
and a data storage; and 

wherein the processor is configured to store the operating data in the operating 
data buffer; and 

wherein the processor is configured, when the information relating to the event 
is received, to store the information relating to event in the operating data buffer in 
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association with the operating data stored in the operating data buffer, to write the stored 
operating data and the information relating to the event from the operating data buffer to the 
data storage, and to identify from the operating data a portion of the operating data relating to 
the event, based on the stored operating data and the information relating to the event written 
to the data storage. 

14. In a management system including a management computer and a 
managed computer to be managed by the management computer, the managed computer 
comprising: 

a processor configured to obtain operating data from a monitoring object and 
to generate information relating to an event indicating trouble occurrence or performance 
decrement of the monitoring object; and 

a communication device configured to identify from the operating data 
obtained from the monitoring object a portion of the operating data which relates to the event, 
based on the operating data and the information relating to the event. 

15. An operating management method for managing one or more 
monitoring objects on the basis of operating data, the operating management method 
comprising: 

receiving the operating data of the monitoring object and information relating 

to an event; 

identifying from the operating data received by the commimication device a 
portion of the operating data which relates to the event, based on the operating data and the 
information relating to the event indicating trouble occurrence or performance decrement of 
the monitoring object; and 

displaying the identified operating data. 

16. The operating management method as set for in claim 15, 
wherein the information relating to the event includes at least one of 

information showing presence or absence of occurrence of the event, information showing an 
occurrence time of the event, and information showing a classification of the event, and 

wherein the identifying comprises identifying the portion of the operating data 
which relates to the event, based on the operating data and the information relating to the 
event including at least one of the information showing presence or absence of occurrence of 
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the event, the information showing the occurrence time of the event, and the information 
showing the classification of the event. 

17. The operating management method as set for in claim 1 5, wherein the 
receiving comprises receiving the operating data of a plurality of monitoring objects, wherein 
the information relating to an event includes host information identifying from the received 
operating data a portion of the operating data which is received from the monitoring object in 
which the event occurred, and wherein the identifying comprises identifying the portion of 
the operating data which relates to the event, based on the operating data and the information 
relating to the event including the host information. 

1 8. The operating management method as set for in claim 17, wherein the 
information relating to the event includes information showing presence or absence of 
occurrence of the event, and wherein the identifying comprises identifying the portion of the 
operating data which relates to the event, based on the operating data and the information 
showing presence or absence of occurrence of the event. 

19. The operating management method as set for in claim 15, further 

comprising: 

storing the operating data in an operating data buffer; and 

when the information relating to the event is received, storing the information 

relating to event in the operating data buffer in association with the operating data stored in 

the operating data buffer, and writing the stored operating data and the information relating to 

the event from the operating data buffer to the data storage; 

wherein the identifying comprises identifying from the operating data a 

portion of the operating data relating to the event, based on the stored operating data and the 

information relating to the event written to the data storage. 

20. In a computer readable medium storing a program for managing a 
monitoring object on the basis of operating data, the program comprising: 

code for receiving the operating data; 

code for identifying from the operating data received by the communication 
device a portion of the operating data which relates to the event, based on the operating data 
and the information relating to the event indicating trouble occurrence or performance 
decrement of the monitoring object; and 
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code for displaying the identified operating data. 
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